Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110625: ClipBucket lets malicious scripts run via flagged_item page

CVE-2026-110625 · published 21 days ago

Summary

The ClipBucket video platform (versions 5 to 5.5.3‑#206) does not safely handle the “type” value in the flagged_item page. An attacker who tricks a logged‑in administrator or moderator into clicking a crafted link can make the admin interface run unwanted code. Apply the vendor’s update or patch the page to properly filter the input.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
macwarrior	clipbucket-v5	<= 5.5.3-#206

Original advisory text

ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

References

https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1... Third Party Advisory
https://github.com/MacWarrior/clipbucket-v5 Product
https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1... Third Party Advisory
https://github.com/MacWarrior/clipbucket-v5/commit/fc593252a18ddea76f82f316bb0c6... Patch
https://hackmd.io/@leediay/BJR_lh2ifg Vendor Advisory
https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-x... Vendor Advisory
https://github.com URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1106... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-110625 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published14 Oct 2026

Updated4 Nov 2026

First seen14 Oct 2026

Sources

CVE-2026-110625 · NVD

CVE-2026-110625 · MITRE

CVE-2026-110625 · OSV

Track software like this

Free during beta